TW201448552A - Privacy-preserving ridge regression - Google Patents
Privacy-preserving ridge regression Download PDFInfo
- Publication number
- TW201448552A TW201448552A TW103107293A TW103107293A TW201448552A TW 201448552 A TW201448552 A TW 201448552A TW 103107293 A TW103107293 A TW 103107293A TW 103107293 A TW103107293 A TW 103107293A TW 201448552 A TW201448552 A TW 201448552A
- Authority
- TW
- Taiwan
- Prior art keywords
- data
- circuit
- service provider
- computing device
- encrypted
- Prior art date
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/008—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols involving homomorphic encryption
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/602—Providing cryptographic facilities or services
-
- G—PHYSICS
- G09—EDUCATION; CRYPTOGRAPHY; DISPLAY; ADVERTISING; SEALS
- G09C—CIPHERING OR DECIPHERING APPARATUS FOR CRYPTOGRAPHIC OR OTHER PURPOSES INVOLVING THE NEED FOR SECRECY
- G09C1/00—Apparatus or methods whereby a given sequence of signs, e.g. an intelligible text, is transformed into an unintelligible sequence of signs by transposing the signs or groups of signs or by replacing them by others according to a predetermined system
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
- H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/04—Masking or blinding
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/24—Key scheduling, i.e. generating round keys or sub-keys for block encryption
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/46—Secure multiparty computation, e.g. millionaire problem
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
- H04L2209/50—Oblivious transfer
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Bioethics (AREA)
- General Health & Medical Sciences (AREA)
- Software Systems (AREA)
- Health & Medical Sciences (AREA)
- Computing Systems (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Mobile Radio Communication Systems (AREA)
- Storage Device Security (AREA)
Abstract
Description
本申請案主張於2013年3月4日提出申請之美國臨時申請案第61/772,404號之權益,該美國臨時申請案以全文引用之方式併入本文中。 The present application claims the benefit of U.S. Provisional Application Serial No. 61/772,404, filed on March 4, 2013, which is hereby incorporated by reference.
本申請案亦與標題為「PRIVACY-PRESERVING RIDGE REGRESSION USING MASKS」及「PRIVACY-PRESERVING RIDGE REGRESSION USING PARTIALLY HOMOMORPHIC ENCRYPTION AND MASKS」之申請案相關,該等申請案已同時提出申請且以全文引用之方式併入本文中。 This application is also related to the application entitled "PRIVACY-PRESERVING RIDGE REGRESSION USING MASKS" and "PRIVACY-PRESERVING RIDGE REGRESSION USING PARTIALLY HOMOMORPHIC ENCRYPTION AND MASKS", which have been filed at the same time and cited in full by Into this article.
本發明大體而言係關於資料探勘且更特定而言係關於使用脊狀回歸來在資料探勘期間維護隱私。 The present invention relates generally to data exploration and, more particularly, to the use of ridge regression to maintain privacy during data mining.
推薦系統藉由收集諸多使用者對不同項目之偏好及評級且對資料運行一學習演算法來操作。該學習演算法產生可用於預測一新使用者將如何評級特定項目之一模型。特定而言,已知一使用者對特定項目提供之評級,模型可預測彼使用者將如何評級其他項目。存在用於產生此預測模組之一龐大演算法陣列,且諸多演算法在如同Amazon及Netflix之大型網站處主動使用。學習演算法亦用於大型醫療資料庫、金融資料及諸多其他領域。 The recommendation system operates by collecting a number of user preferences and ratings for different projects and running a learning algorithm on the data. The learning algorithm produces a model that can be used to predict how a new user will rate a particular item. In particular, a user is known to provide a rating for a particular project, and the model predicts how the user will rate other projects. There is a large array of algorithms used to generate this predictive module, and many algorithms are actively used at large sites like Amazon and Netflix. Learning algorithms are also used in large medical databases, financial materials and many other fields.
在目前實施方案中,學習演算法必須查看所有未加密之使用者資料以便建立預測模型。在本發明中,判定學習演算法是否可在無未加密之資料之情況下進行運算,藉此允許使用者保持對其資料之控制。針對醫療資料,此允許在不影響使用者隱私之情況下建立一模型。針對書籍及電源偏好,讓使用者保持對其資料之控制減少在服務提供者處之一資料缺口之情形中之未來不期望阻礙之風險。大致而言,存在用以資料探勘私用使用者資料之三種現有方法。第一種方法讓使用者使用秘密共用將其資料分割在多個伺服器當中。此等伺服器然後使用一分散式協定運行學習演算法且只要伺服器之大部分不串通即確保隱私。第二種方法係基於完全同態加密,其中對經加密資料執行學習演算法且一受信任第三方經委託以僅解密最終經加密模型。在一第三方法中,Yao之混淆電路構造可用於對經加密資料進行計算且在不學習關於使用者資料之任何其他資料之情況下獲得一最終模型。然而,基於Yao之一方法之前從未應用於回歸級演算法。 In the current implementation, the learning algorithm must view all unencrypted user data in order to build a predictive model. In the present invention, it is determined whether the learning algorithm can perform operations without unencrypted data, thereby allowing the user to maintain control over their data. For medical data, this allows a model to be built without affecting user privacy. For books and power preferences, allowing users to maintain control over their data reduces the risk of future undesired obstacles in the event of a data gap at one of the service providers. In general, there are three existing methods for data mining private user data. The first method allows the user to split his data into multiple servers using secret sharing. These servers then use a decentralized protocol to run the learning algorithm and ensure privacy as long as most of the server does not collude. The second method is based on fully homomorphic encryption, in which a learning algorithm is performed on the encrypted material and a trusted third party is commissioned to decrypt only the final encrypted model. In a third method, the Ya confusion circuit configuration can be used to calculate the encrypted data and obtain a final model without learning any other data about the user data. However, one of the methods based on Yao has never been applied to regression-level algorithms before.
本發明呈現一種使用同態加密及Yao混淆電路兩者之用以隱私保護之脊狀回歸之混合方法。系統中之使用者提交其依據諸如Paillier或Regev之一線性同態加密系統加密之資料。評估器使用線性同態來實施僅需要線性運算之演算法之第一階段。此階段產生經加密資料。在此第一階段中,要求系統處理大量記錄(與系統中之使用者之數目n成比例)。此第一階段中之處理準備資料以使得演算法之第二階段與n無關。在一第二階段中,評估器評估一Yao混淆電路,該Yao混淆電路首先實施同態解密且然後進行回歸演算法之剩餘部分(如所示,一最佳化實現可避免混淆電路中之解密)。回歸演算法之此步驟需要一快速線性系統求解器且係高度非線性。針對此步驟,一Yao混淆電路方法比目前完全同態加密方案快得多。因此,藉由使用線性同態來處置 一大資料集且將混淆電路用於計算之繁重非線性部分來獲得兩個領域之最佳。由於計算經分割成兩個階段之方式,因此第二階段亦與n無關。 The present invention presents a hybrid method for ridge regression using privacy protection using both homomorphic encryption and Yao confusion circuits. Users in the system submit data that is encrypted according to a linear homomorphic encryption system such as Paillier or Regev. The evaluator uses a linear homomorphism to implement the first phase of an algorithm that requires only linear operations. This stage produces encrypted data. In this first phase, the system is required to process a large number of records (proportional to the number n of users in the system). The processing preparation data in this first phase is such that the second phase of the algorithm is independent of n. In a second phase, the evaluator evaluates a Yao obfuscation circuit that first performs homomorphic decryption and then performs the remainder of the regression algorithm (as shown, an optimized implementation avoids confusion in the obfuscated circuit ). This step of the regression algorithm requires a fast linear system solver and is highly nonlinear. For this step, a Yao obfuscation circuit method is much faster than the current fully homomorphic encryption scheme. Therefore, by using linear homomorphism A large data set and the obfuscated circuit is used to calculate the heavy non-linear part to get the best of both fields. Since the calculation is divided into two phases, the second phase is also independent of n.
在一項實施例中,提供用於隱私保護之脊狀回歸之方法。方法包含以下步驟:向一密碼編譯服務提供者請求一混淆電路;自多個使用者收集已使用同態加密格式化並加密之資料;匯合已使用同態加密格式化並加密之該資料;及使用模糊傳送用該經匯合資料來評估來自該密碼編譯服務提供者之該混淆電路。 In one embodiment, a method for ridge regression of privacy protection is provided. The method comprises the steps of: requesting a confusing circuit from a cryptographic service provider; collecting data that has been formatted and encrypted using homomorphic encryption from a plurality of users; merging the data that has been formatted and encrypted using homomorphic encryption; The merged data is used to evaluate the obfuscation circuit from the cryptographic service provider using fuzzy delivery.
在另一實施例中,提供用於隱私保護之脊狀回歸之計算裝置。該計算裝置包含儲存器件、記憶體及一處理器。該儲存器件用於儲存使用者資料。該記憶體用於儲存用於處理之資料。該處理器經組態以向一密碼編譯服務提供商請求一混淆電路,自多個使用者收集已使用同態加密格式化並加密之資料,匯合已使用同態加密格式化並加密之該資料,及使用模糊傳送用該經匯合資料來評估來自該密碼編譯服務提供者之該混淆電路。 In another embodiment, a computing device for ridge regression of privacy protection is provided. The computing device includes a storage device, a memory, and a processor. The storage device is used to store user data. This memory is used to store data for processing. The processor is configured to request a confusing circuit from a cryptographic service provider to collect data that has been formatted and encrypted using homomorphic encryption from a plurality of users, converging the data that has been formatted and encrypted using homomorphic encryption. And using the merged data to evaluate the obfuscation circuit from the cryptographic service provider using fuzzy transmission.
目的及優點將藉助於申請專利範圍中特定指出之元件及耦合件實現及獲得。重要地,注意所揭示之實施例僅係本文中之創新教示內容之諸多有利用途之實例。應理解,前述一般說明及以下詳細說明兩者皆為實例性及解釋性的且並不限制如所主張之本發明。此外,某些陳述可適用於某些發明性特徵而不適用於其他特徵。一般而言,除非另有指示,否則在不失一般性之情形下,單數個元素可呈複數形式且反之亦然。在圖式中,在所有數個視圖中相似編號係指相似部件。 The objects and advantages will be realized and attained by means of the <RTIgt; It is important to note that the disclosed embodiments are merely examples of the many advantageous uses of the innovative teachings herein. It is to be understood that both the foregoing general description In addition, some statements may apply to certain inventive features and not to other features. In general, a single element may be in the plural and vice versa without loss of generality unless otherwise indicated. In the drawings, like numerals refer to the like parts throughout the several views.
100‧‧‧系統 100‧‧‧ system
110‧‧‧評估器 110‧‧‧Evaluator
120‧‧‧使用者 120‧‧‧Users
130‧‧‧密碼編譯服務提供者 130‧‧‧Cryptographic Compilation Service Provider
140‧‧‧純文字預測模型β/學習模型β/模型β 140‧‧‧Pure text prediction model β/learning model β/model β
200‧‧‧計算裝置/電子伺服器/處理器/伺服器 200‧‧‧Computing device / electronic server / processor / server
210‧‧‧處理器 210‧‧‧ processor
220‧‧‧記憶體 220‧‧‧ memory
230‧‧‧儲存器件 230‧‧‧Storage devices
240‧‧‧網路介面 240‧‧‧Internet interface
300‧‧‧布林電路 300‧‧‧Brin Circuit
310‧‧‧線w i /輸入線 310‧‧‧Line w i /Input line
320‧‧‧線w i /輸入線 320‧‧‧Line w i /Input line
330‧‧‧輸出線 330‧‧‧Output line
g‧‧‧二進制閘 g‧‧‧Binary gate
圖1繪示根據一實施例之一隱私保護之脊狀回歸系統之一區塊示意圖。 1 is a block diagram of a ridge regression system for privacy protection according to an embodiment.
圖2繪示根據一實施例之一計算裝置之一區塊示意圖。 2 is a block diagram of a block of a computing device in accordance with an embodiment.
圖3繪示根據一實施例之一例示性混淆電路。 FIG. 3 illustrates an exemplary obfuscation circuit in accordance with an embodiment.
圖4繪示根據實施例之用於提供一隱私保護之脊狀回歸之一方法之一高階流程圖。 4 illustrates a high-level flow diagram of one of the methods for providing a privacy-requested ridge regression, in accordance with an embodiment.
圖5繪示根據實施例之用於提供隱私保護之脊狀回歸之一第一協定之操作。 5 illustrates the operation of one of the first agreements for providing a ridge regression of privacy protection in accordance with an embodiment.
圖6繪示根據實施例之用於提供隱私保護之脊狀回歸之一第一協定之操作。 6 illustrates the operation of one of the first agreements for providing a ridge regression of privacy protection in accordance with an embodiment.
圖7繪示根據實施例之用於喬裏斯基(Cholesky)分解之一演算法之一例示性實施例。 FIG. 7 illustrates an exemplary embodiment of an algorithm for Cholesky decomposition, in accordance with an embodiment.
本發明之重點係關於諸多學習演算法中所使用之一基本機制,即,脊狀回歸。已知處於高維度中之大量點,回歸演算法透過此等點產生一最佳擬合曲線。目標係在不曝露使用者資料或關於使用者資料之任何其他資訊之情況下執行計算。此係藉由使用如圖1中所示之一系統達成:在圖1中,提供用於實施隱私保護之脊狀回歸之一系統100之一實施例之一方塊圖。系統包含彼此通信之一評估器110,一或多個使用者120及密碼編譯服務提供者(CSP)130。評估器110實施於諸如一伺服器或個人電腦(PC)之一計算裝置上。CSP 130係類似地實施於諸如一伺服器或個人電腦之計算裝置上且經由網路(諸如乙太網路或Wi-Fi網路)與評估器110通信。一或多個使用者120經由諸如個人電腦、平板電腦、智慧型電話或諸如此類之計算裝置與評估器110及CSP 130通信。 The focus of the present invention is on one of the basic mechanisms used in many learning algorithms, namely, ridge regression. A large number of points in the high dimension are known, and the regression algorithm produces a best fit curve through these points. The objective is to perform the calculation without exposing the user's data or any other information about the user's data. This is achieved by using a system as shown in Figure 1: In Figure 1, a block diagram of one of the embodiments of one of the ridge regression systems 100 for implementing privacy protection is provided. The system includes one of the evaluators 110, one or more users 120, and a cryptographic service provider (CSP) 130 in communication with each other. The evaluator 110 is implemented on a computing device such as a server or a personal computer (PC). The CSP 130 is similarly implemented on a computing device such as a server or personal computer and communicates with the evaluator 110 via a network, such as an Ethernet or Wi-Fi network. One or more users 120 communicate with the evaluator 110 and the CSP 130 via a computing device such as a personal computer, tablet, smart phone or the like.
使用者120將經加密資料(舉例而言,來自一PC)發送至運行學習演算法之評估器110(舉例而言,在一伺服器上)。在特定時刻,評估器可與被信任不與評估器110串通之一密碼編譯服務提供者130(在另 一伺服器上)互動。最終結果係純文字預測模型β 140。 The user 120 sends the encrypted material (for example, from a PC) to an evaluator 110 (e.g., on a server) that runs the learning algorithm. At a particular time, the evaluator can compile the service provider 130 with one of the passwords that are trusted not to collude with the evaluator 110 (in another On a server) interact. The final result is the plain text prediction model β 140.
圖2繪示可用於實施用於隱私維護之脊狀回歸之各種方法及系統元件之諸如一伺服器、PC、平板電腦或智慧型電話之一例示性計算裝置200。計算裝置200包含一或多個處理器210、記憶體220、儲存器件230及一網路介面240。下文將更詳細論述此等元件中之每一者。 2 illustrates an exemplary computing device 200, such as a server, PC, tablet, or smart phone, that can be used to implement various methods and system components for ridge regression for privacy maintenance. The computing device 200 includes one or more processors 210, a memory 220, a storage device 230, and a network interface 240. Each of these elements is discussed in more detail below.
處理器210控制電子伺服器200之操作。處理器200運行操作伺服器以及提供冷啟動推薦之功能性之軟體。處理器210連接至記憶體220、儲存器件230及網路介面240,且處置此等元件之間的資訊之傳送及處理。處理器210可係一般處理器或專用於一特定功能性之一處理器。在某些實施例中,可存在多個處理器。 The processor 210 controls the operation of the electronic server 200. The processor 200 runs an operational server and provides functional software recommended for cold start. The processor 210 is coupled to the memory 220, the storage device 230, and the network interface 240, and handles the transfer and processing of information between the elements. Processor 210 can be a general purpose processor or a processor dedicated to a particular functionality. In some embodiments, there may be multiple processors.
記憶體220其中儲存由處理器執行之指令及資料。記憶體210可包含揮發性記憶體(RAM)、非揮發性記憶體(EEPROM)或其他適合媒體。 The memory 220 stores instructions and data executed by the processor. Memory 210 can include volatile memory (RAM), non-volatile memory (EEPROM), or other suitable medium.
儲存器件230其中儲存處理器在執行本發明之冷儲存推薦方法中所使用及產生之資料。儲存器件可係磁性媒體(硬碟機)、光學媒體(CD/DVD-Rom)或基於快閃之儲存器件。 The storage device 230 stores therein the data used and generated by the processor in performing the cold storage recommendation method of the present invention. The storage device can be a magnetic media (hard disk drive), an optical media (CD/DVD-Rom) or a flash-based storage device.
網路介面240處置伺服器200與其他裝置經由一網路之通信。一適合網路之一實例係一乙太網路。已知本發明之益處,熟習此項技術者將明瞭其他類型之適合家用網路。 The network interface 240 handles the communication between the server 200 and other devices via a network. One example of a suitable network is an Ethernet network. Knowing the benefits of the present invention, those skilled in the art will recognize other types of suitable home networks.
應理解,圖2中所闡明之元件係說明性。伺服器200可包含任何數目個元件且某些元件可提供其他元件之功能之部分或全部。已知本發明之益處,熟習此項技術者將明瞭其他可能實施方案。 It should be understood that the elements illustrated in Figure 2 are illustrative. Server 200 can include any number of elements and some elements can provide some or all of the functionality of other elements. The benefits of the present invention are known, and other possible embodiments will be apparent to those skilled in the art.
返回參考圖1,系統100經設計用於諸多使用者120以將資料貢獻至稱為評估器110之一中央伺服器。評估器110對所貢獻資料執行回歸 且產生一模型β 140,該模型稍後可用於預測或推薦任務。更具體而言,每一使用者i=1;:::;n具有包括兩個變數及之一私用記錄,且評估器希望計算-模型-以使得。目標係確保評估器不學習除由β 140揭示之資料(回歸演算法之最終結果)外之關於使用者之記錄之任何資料。為初始化系統,需要離線進行其工作之大部分之一第三方(其在本文中稱為一「密碼編譯服務提供者」)。 Referring back to FIG. 1, system 100 is designed for use by a plurality of users 120 to contribute data to a central server, referred to as evaluator 110. The evaluator 110 performs regression on the contributed data and produces a model β 140 that can later be used to predict or recommend a task. More specifically, each user i =1;:::; n has two variables and One of the private records, and the evaluator wants to calculate - model - to make . The goal is to ensure that the evaluator does not learn any information about the user's records other than the information revealed by β 140 (the final result of the regression algorithm). To initialize the system, a third party (which is referred to herein as a "cryptographic build service provider") that performs most of its work offline is required.
更精確而言,系統中之該等各方係如下,如圖1中所示。 More precisely, the parties in the system are as follows, as shown in Figure 1.
.使用者120:每一使用者i使其發送之私用資料x i ,y i 經加密至評估器110。 . User 120: i so that each user's private data transmitted x i, y i to the encrypted evaluator 110.
.評估器110:對經加密資料運行一回歸演算法且獲得未加密之學習模型β 140。 . The evaluator 110: runs a regression algorithm on the encrypted data and obtains an unencrypted learning model β 140.
.密碼編譯服務提供者(CSP)130:藉由賦予設定參數至使用者120及評估器110來初始化系統100。 . Cryptographic Compilation Service Provider (CSP) 130: Initializes system 100 by assigning setting parameters to user 120 and evaluator 110.
CSP 130遠在使用者120將其資料貢獻至評估器110之前離線進行其工作之大部分。在最高效設計中,在評估器110計算模型β 140時一短單回合線上步驟亦需要CSP 130 The CSP 130 goes far to the bulk of its work before the user 120 contributes his or her data to the evaluator 110. In the most efficient design, the CSP 130 is also required on the short single round line step when the evaluator 110 calculates the model β 140.
目標係確保評估器110及CSP 130無法學習除由學習演算法之最終結果揭示之資料外之關於由使用者120貢獻之資料之任何資料。在評估器110與使用者120中之某些使用者串通之情形中,使用者120不應學習除由學習演算法之結果揭示之資料外之關於由其他使用者120貢獻之資料之任何資料。 The goal is to ensure that the evaluator 110 and the CSP 130 are unable to learn any information about the material contributed by the user 120 other than the information revealed by the final result of the learning algorithm. In the event that the evaluator 110 is in collusion with some of the users 120, the user 120 should not learn any material other than the material disclosed by the results of the learning algorithm regarding the information contributed by the other users 120.
在此實例中,假定產生一正確模型β 140係評估器110之最佳利益。因此,此實施例並不與試圖損毀計算以希望產生一不正確結果之一惡意評估器110相關。然而,評估器110經誘導而行為不端且學習關 於由使用者120貢獻之私用資料之資訊,此乃因此資料可能被出售給其他方(例如,廣告客戶)。因此,甚至一惡意評估器110應不能夠學習除由學習演算法之結果揭示之資料以外之關於使用者資料之任何資料。本文中闡明僅沒有一誠實但好奇評估器之危險之基本協定。 In this example, it is assumed that the best benefit of generating a correct model beta 140 estimator 110 is achieved. Thus, this embodiment is not related to the malicious evaluator 110 that attempts to corrupt the computation in order to produce an incorrect result. However, the evaluator 110 is induced to be misbehaving and learning to close The information on the private data contributed by the user 120 is such that the information may be sold to other parties (eg, advertisers). Therefore, even a malicious evaluator 110 should be able to learn any information about the user's data other than the information revealed by the results of the learning algorithm. This article states that there is only one basic agreement that is not honest but curious about the dangers of the evaluator.
無威脅:系統經設計以防禦以下攻擊: No threat: The system is designed to defend against the following attacks:
.假定評估器110及CSP130不串通。每一者可如上文所論述試圖破壞系統,但其獨立如此進行。更精確而言,在辯論安全性時,假定此兩個方中至多一者係惡意的(此係一固有要求,在無該固有要求之情況下無法達成安全性)。 . It is assumed that the evaluator 110 and the CSP 130 are not collusive. Each can attempt to destroy the system as discussed above, but it does so independently. More precisely, in debating security, it is assumed that at most one of the two parties is malicious (this is an inherent requirement that security cannot be achieved without this inherent requirement).
.假定設定工作正確,亦即,所有使用者120自CSP 130獲得正確公用密鑰。此可實際上在適當使用憑證機構之情況下強制執行。 . It is assumed that the setting is working correctly, that is, all users 120 get the correct public key from the CSP 130. This can actually be enforced with the appropriate use of a credential authority.
簡要回顧脊狀回歸,評估器110在系統110中進行以學習β 140之演算法。下文所論述之所有結果係典型的,且可在大部分統計及機器學習教科書中找到。 Briefly reviewing the ridge regression, evaluator 110 performs in system 110 to learn the algorithm of β 140. All of the results discussed below are typical and can be found in most statistical and machine learning textbooks.
線性回歸:已知一組n個輸入變數,及一組輸出變數,學習一函數以使得之一問題稱為回歸。舉例而言,輸入變數可係一人類之年齡、體重、身體質量指數等,而輸出可係其感染一疾病之可能性。 Linear regression : a set of n input variables is known And a set of output variables , learning a function So that One problem is called regression . For example, the input variable can be a human age, weight, body mass index, etc., and the output can be a possibility of infecting a disease.
自實際資料學習此一函數具有使回歸在資料探勘、統計及機器學習中遍存之諸多興趣應用。一方面,函數自身可用於預測,亦即,預測一新輸入之輸出值y。此外,f之結構可有助於識別輸入影響輸出之困難程度-確立例如體重而非年齡與一疾病更強烈相關。 Learning from actual data has a number of interesting applications that allow regression to exist in data mining, statistics, and machine learning. On the one hand, the function itself can be used for prediction, that is, predicting a new input. The output value y . In addition, the structure of f can help to identify the extent to which the input affects the output - establishing, for example, weight rather than age is more strongly associated with a disease.
線性回歸係基於f係由一線性映射充分近似化之前提,亦即,
如上文所提及,除其明顯用於預測外,向量β=(β k ) k=1,...,d 在其解釋y依賴於輸入變數之程度時令人感興趣。特定而言,一係數β k 之正負號指示與輸出之正相關或負相關,而量值決定相對重要性。為確保此等係數係可比較,而且實現數值穩定性,係數x i 經重新調節至相同有效值域(例如,[-1;1])。 As mentioned above, except that it is obviously used for prediction, the vector β = (β k ) k = 1, ..., d is of interest when its interpretation y depends on the degree of the input variable. In particular, the sign of a coefficient β k indicates a positive or negative correlation with the output, while the magnitude determines the relative importance. To ensure that these coefficients are comparable and numerical stability is achieved, the coefficient x i is readjusted to the same effective range (eg, [-1; 1]).
計算係數:為計算向量,該向量藉由使以下關於之二次函數最小化而擬合於資料:
使(1)最小化之程序稱為脊狀回歸;目標函數F(β)併入有懲罰項,該懲罰項有助於簡約解。直觀地,針對λ=0,使(1)最小化對應於求解一簡單最小平方問題。針對正λ>0,項用高范數懲罰解:在同樣擬合資料之兩個解之間,具有較不大係數之解係較佳的。回想,β之係數係輸入影響輸出之程度之指標,此充當「奧坎簡化論」之一形式:具有較不大係數之較簡單解係較佳的。實際上,一λ>0比所基於之最小平方解對新輸入賦予實際上較佳預測。假設係輸出之向量且係包括輸入向量(每一列中之向量)之一矩陣,亦即,
可藉由求解線性系統計算(1)之最小值:Aβ=b (2) The minimum value of (1) can be calculated by solving the linear system: Aβ = b (2)
其中A=X T X+λI且b=X T y。針對λ>0,矩陣A係對稱正定的,且可如下文所概述使用喬裏斯基分解找到一高效解。 Where A = X T X + λI and b = X T y . For λ > 0, matrix A is symmetrically positive definite and can be found using the Cholesky decomposition as outlined below.
在其基本版本中,Yao之協定(亦稱為混淆電路)允許在存在半誠實敵人之情況下對一函數f(x 1 ;x 2 )之雙方評估。協定在輸入擁有者之間運行(a i 表示使用者i之私用輸入)。在協定結束時,獲得f(a 1 ;a 2 )之值但無任何一方學習比自此輸出值所揭示之資料多之資料。 In its basic version, the agreement of Yao (also known as the obfuscation circuit) allows evaluation of both sides of a function f(x 1 ; x 2 ) in the presence of a semi-honest enemy. The agreement runs between the input owners ( a i represents the private input of user i ). At the end of the agreement, the value of f(a 1 ; a 2 ) is obtained but no party learns more information than the information revealed from this output.
協定如下進行。第一方(稱為混淆器)建立計算f之一電路之一「混淆」版本。混淆器然後賦予第二方(稱為評估器)混淆電路以及對應於a 1 之混淆電路輸入值(且僅彼等者)。記號GI(a 1 )用於表示此等輸入值。混淆器亦提供混淆電路輸出值與實際位元值之間的映射。在接收電路時,評估器以一2選1模糊傳送協定與混淆器接合,起到選擇器之作用,以便模糊獲得對應於其私用輸入a 2 之混淆電路輸入值 GI(a 2 )。自GI(a 1 )及GI(a 2 ),評估器可因此計算f(a 1 ;a 2 )。 The agreement is as follows. The first party (called the obfuscator) establishes a "confused" version of one of the circuits that computes f . Confusion may then impart a second party (referred evaluator) corresponding to a confusing and obscure circuit circuit input value 1 (and only by their). The token GI (a 1 ) is used to represent these input values. The obfuscator also provides a mapping between the obfuscated circuit output value and the actual bit value. In the receiving circuit, the evaluator is coupled to the obfuscator by a 2-to-1 fuzzy transfer protocol, acting as a selector to blur the obfuscated circuit input value GI( a 2 ) corresponding to its private input a 2 . From GI( a 1 ) and GI( a 2 ), the evaluator can therefore calculate f( a 1 ; a 2 ).
更詳細而言,協定評估透過如圖3中所見之一布林電路(Boolean circuit)300評估函數f。混淆器使分別對應於位元值b i =0及b i =1之兩個隨機密碼編譯密鑰及與電路之每一線w i 310、320相關聯。接下來,針對具有輸入線(w i ,w j )310、320及輸出線w k 330之每一二進制閘g(例如,一「或」閘),混淆器計算四個密文
此等四個隨機排序密文之集定義混淆閘。 These four sets of randomly ordered ciphertexts define confusion gates.
需要藉由一對密鑰予以密鑰控制之對稱加密演算法Enc在所選擇明文攻擊下具有難以辨別之加密。亦要求,已知密鑰對(,),對應解密程序自構成混淆閘之四個密文明確地復原之值。對(,)之知曉僅產生之值,且針對此閘無法復原任何其他輸出值。因此評估器可逐閘評估整個混淆電路以使得不洩漏關於中間計算之任何額外資訊。 The symmetric encryption algorithm Enc, which requires key control by a pair of keys, has an indistinguishable encryption under the selected plaintext attack. Also requires a known key pair ( , ), the corresponding decryption program is explicitly restored from the four ciphertexts that constitute the confusion gate The value. Correct( , Knowledge only produced The value and no other output values can be restored for this gate. The evaluator can therefore evaluate the entire obfuscated circuit on a one-off basis so that no additional information about the intermediate calculation is leaked.
回想,在此設定中,每一輸入及輸出變數x i 、y i (i [n])係私用的,且由一不同使用者保留。評估器110希望學習判定輸入變數與輸出變數之間的線性關係之β(如在一已知λ>0之情況下透過脊狀回歸獲得)。 Recall that in this setting, each input and output variable x i , y i ( i [ n ]) is private and reserved by a different user. The evaluator 110 wishes to learn a β that determines the linear relationship between the input variable and the output variable (as obtained by ridge regression with a known λ > 0).
如上文中所闡述,為獲得β,需要矩陣及向量,如方程式(2)中所定義。一旦獲得此等值,評估器110可求解方程式(2)之線性系統且提取β。存在以一隱私保護方式解決此問題之數種方式。舉例而言,一個方式可依賴於秘密共用或完全同態加密。目前,此等技術似乎不適合於本設定,此乃因其導致顯著(線上)通信或計算附加項。因此,如上文中所概述,探究了Yao之方法。 As explained above, in order to obtain β , a matrix is needed. And vector , as defined in equation (2). Once this value is obtained, the evaluator 110 can solve the linear system of equation (2) and extract β . There are several ways to solve this problem in a privacy-protected way. For example, one approach may rely on secret sharing or fully homomorphic encryption. Currently, these technologies do not appear to be suitable for this setting because they result in significant (online) communication or calculation of additional items. Therefore, as outlined above, the method of Yao is explored.
使用Yao之方法之一個簡單方式係設計針對i [n]且λ>0具有輸入x i 、y i 之一單個電路,該單個電路計算矩陣A及b且隨後求解系統Aβ=b。此一方法過去已用於對來自多個使用者(諸如一拍賣之得標者)之輸入之簡單函數之計算,。撇開執行問題(諸如如何設計求解一線性系統之一電路),此一解決方案之一主要缺點係所得混淆電路取決於使用者之數目n以及β與輸入變數之維度d兩者。在實際應用中,較常見地,n係較大的,且可係大約數百萬使用者。相比而言,d係相對較小,大約10s。因此較佳減少或甚至消除混淆電路對n之相依性,一般獲得一可擴縮解決方案。為此,問題如下文所論述重新格式化。 A simple way to use Yao's method is to design for i [ n ] and λ>0 has a single circuit of inputs x i , y i that computes matrices A and b and then solves the system Aβ = b . This method has been used in the past for the calculation of simple functions for input from multiple users, such as the winner of an auction. Leaving aside the question of implementation (such as how to design a linear system to solve one of the circuit), the resulting solution to one major disadvantage of this system depends on the number of user confusion circuit of dimension n and β d of the two input variables. In practice, the more common ground, n larger system, and can be tied around millions of users. In contrast, the d system is relatively small, about 10 s. Therefore, it is preferable to reduce or even eliminate the dependency of the confusing circuit on n, and generally obtain a scalable solution. To this end, the problem is reformatted as discussed below.
注意,矩陣A及向量b可如下以一迭代方式計算。假定每一x i 及對應y i 由不同使用者保留,且使用者i可本端計算矩陣及向量b i =y i x i 。然後容易驗證,對部分貢獻求和產生:
方程式(3)重要展示A及b係一系列加法之結果。評估器之回歸任務可因此分成兩個子任務:(a)收集A i 及b i 以構造矩陣A及向量b,及(b)使用此等來透過線性系統(2)之解來獲得β。 Equation (3) A and b show an important result of the addition of a series of lines. The evaluator's regression task can thus be divided into two subtasks: (a) collecting A i and b i to construct matrix A and vector b , and (b) using this to obtain β through the solution of linear system (2).
當然,使用者無法發送其本端共用(A i ;b i )至未加密之評估器。然而,若評估器使用一公用密鑰加性同態加密方案來加密,則評估器110可自對(A i ;b i )之加密重新構造對A及b之加密。剩餘挑戰係藉助於CSP 130求解方程式(2),而不揭示(至評估器110或CSP 130)除β外之任何額外資訊;下文闡述透過使用Yao之混淆電路如此操作之兩個不同方式。 Of course, the user cannot send its local share ( A i ; b i ) to the unencrypted evaluator. However, if the evaluator is encrypted using a public key additive homomorphic encryption scheme, the evaluator 110 can reconstruct the encryption of A and b from the encryption of ( A i ; b i ). The remaining challenge is to solve equation (2) by means of CSP 130 without revealing (to evaluator 110 or CSP 130) any additional information other than beta ; the following illustrates two different ways of doing so by using the aliasing circuit of Yao.
更明確地,假設
係藉由一公用密鑰pk索引之一語義安全加密方案,該方案在訊息空間M中接受輸入(一對(A i ;b i ))且在pk,c i 下返回對(A i ;b i )之加密。然後,其必須適用於任何pk及任何兩個對(A i ;b i )、(A j ;b j )。以使得
針對某些公用二進制運算子。此一加密方案可藉由按分量加密A i 及b i 之項目來由任何語義安全加性同態加密方案構造。實例包含Regev方案及Paillier方案。 For some common binary operators. This encryption scheme may be a component-by encryption program A i and b i reason of any semantic security additive homomorphic encryption scheme configured. Examples include the Regev scheme and the Paillier scheme.
現在準備呈現協定。圖4中提供一高階流程圖400。流程圖400包含一準備階段410、一第一階段(階段1)420及一第二階段(階段2)430。彙總使用者共用之階段稱為階段1 420,且注意其涉及之加法線性依賴於n。隨後階段(其相當於依據A及b之經加密值計算方程式(2)之解)稱為階段2 430。應注意,階段2 430與n不相關。下文將結合特定協定論述此等階段。注意,假定下文存在可求解系統Aβ=b之一電路;本文中論述可如何高效實施此一電路。 Now ready to present the agreement. A high level flow diagram 400 is provided in FIG. Flowchart 400 includes a preparation phase 410, a first phase (phase 1) 420, and a second phase (phase 2) 430. The stage of summarizing user sharing is called stage 1 420, and it is noted that the addition involved is linearly dependent on n . The subsequent stage, which is equivalent to calculating the solution of equation (2) based on the encrypted values of A and b , is referred to as stage 2 430. It should be noted that stage 2 430 is not related to n . These stages are discussed below in connection with specific agreements. Note that it is assumed below that there is a circuit that can solve one of the systems Aβ = b ; how this circuit can be implemented efficiently is discussed herein.
第一協定之操作之一高階繪示500可在圖5中看到。第一協定如下操作。如上文所闡明,第一協定包括三個階段:一準備階段510、階段1 520及階段2 530。如將瞭解,僅階段2 530實際需要一線上處理。 A high-order depiction 500 of one of the operations of the first protocol can be seen in FIG. The first agreement operates as follows. As explained above, the first agreement includes three phases: a preparation phase 510, a phase 1 520, and a phase 2 530. As will be appreciated, only Phase 2 530 actually requires an on-line process.
準備階段(510)。評估器110提供規格至CSP 130,諸如輸入變數之維度(亦即,參數d)及其值範圍。CSP 130準備用於階段2 530中所闡述之電路之一Yao混淆電路且使混淆電路可用於評估器110。CSP 130亦產生用於同態加密方案之一公用密鑰pk csp 及一私用密鑰sk csp ,而評估器110產生用於加密方案ε(其不需要係同態)之一公用密鑰pk ev 及 一私用密鑰sk ev 。 Preparation phase (510). The evaluator 110 provides specifications to the CSP 130, such as the dimension of the input variable (i.e., parameter d ) and its range of values. The CSP 130 is ready for one of the circuits described in Phase 2 530, the Ya confusion circuit and the aliasing circuit is available to the evaluator 110. CSP 130 is also generated for homomorphic encryption schemes One of the public key pk csp and a private key sk csp , and the evaluator 110 generates a public key pk ev and a private key sk ev for the encryption scheme ε (which does not need to be homomorphic).
階段1(520)。每一使用者i本端計算器部分矩陣A i 及向量b i 。然後可在CSP 130之公用加密密鑰pk csp 下使用加性同態加密方案來加密此等值;亦即,
為防止CSP 130存取此值,使用者i在評估器110之公開加密密鑰pk ev 下超級加密c i 之值;亦即,
且將C i 發送至評估器110。 And C i is sent to the evaluator 110.
評估器110計算。該評估器隨後收集所有所接收C i 且使用其私用解密密鑰sk ev 來將其解密以復原c i ;亦即,,針對1 i n Evaluator 110 calculates . The evaluator then collects all received C i and uses its private decryption key sk ev to decrypt it to recover c i ; that is, For 1 i n
然後該評估器彙總所獲得值且得到:
階段2(530)。在準備階段510中由CSP 130提供之混淆電路係取作輸入GI(c)且進行以下兩個步驟之一電路之一混淆:1)用sk csp 解密c以復原A及b(此處sk csp 嵌入於混淆電路中);及2)求解方程式(2)且返回β。 Phase 2 (530). The obfuscation circuit provided by the CSP 130 in the preparation phase 510 is taken as input GI(c) and is confused with one of the following two steps: 1) decrypt c with sk csp to restore A and b (here sk csp Embedded in the obfuscation circuit); and 2) solve equation (2) and return β .
在此階段2 530中,評估器110僅需要獲得對應於c之混淆電路輸入值;亦即,GI(c)。此等值係評估器110與CSP 130之間使用一標準模糊傳送(OT)獲得。 In this stage 2 530, the evaluator 110 only needs to obtain the aliasing circuit input value corresponding to c; that is, GI(c). This value is obtained between the evaluator 110 and the CSP 130 using a standard fuzzy transfer (OT).
上述混合計算在混淆電路內對經加密輸入執行一解密。在上述情形可需要時,建議使用(舉例而言)Regev同態加密方案作為用於 之建立區塊,此乃因Regev方案具有一極其簡單解密電路。 The hybrid calculation described above performs a decryption of the encrypted input within the obfuscation circuit. When the above situation may be required, it is recommended to use, for example, the Regev homomorphic encryption scheme as The block is created because the Regev scheme has an extremely simple decryption circuit.
第二協定之操作之一高階繪示600可在圖6中看到。第二協定呈現使用隨機遮罩來避免在混淆電路中解密(A;b)之一修改方案。階段1 610大體上保持相同。因此將強調提示階段2(及對應準備階段)。概念係利用同態性質來用一加性遮罩模糊輸入。注意,若(μ A ;μ b )表示M(即,同態加密)之訊息空間)中之一元素,則其依據方程式(4)得出:
因此,假定評估器110在M中選擇一隨機遮罩(μ A ;μ b ),如上文所述模糊c,且將所得值發送至CSP 130。然後,CSP 130可應用其解密密鑰且復原經遮罩值
因此,可在將解密替換為移除遮罩之情況下應用先前章節之協定。更詳細而言,其涉及:準備階段(610)。如之前,評估器110設立評估。評估器110提供規格至CSP 130以建立支援其評估之一混淆電路。CSP 130準備電路且使其可用於評估器110,且兩者皆產生公用及私用密鑰。評估器110選擇一隨機遮罩且以一模糊傳送(OT)協定與CSP 130接合以獲得對應於(μ A ;μ b )之混淆電路輸入值;亦即,GI(μ A ;μ b )。 Therefore, the agreement of the previous section can be applied with the decryption replaced with the removal mask. In more detail, it relates to the preparation phase (610). As before, the evaluator 110 sets up an assessment. The evaluator 110 provides specifications to the CSP 130 to establish an obfuscation circuit that supports its evaluation. The CSP 130 prepares the circuit and makes it available to the evaluator 110, and both generate a public and private key. The evaluator 110 selects a random mask And engaging the CSP 130 with an ambiguous transfer (OT) protocol to obtain an aliasing circuit input value corresponding to ( μ A ; μ b ); that is, GI ( μ A ; μ b ).
階段1(620)。此類似於第一協定。另外,評估器110遮罩c作為
階段2(630)。評估器110將發送至CSP 130,該CSP 130將其解密以獲得未加密之。CSP 130然後將混淆輸入值往回發送至評估器110。在準備階段由CSP 130提供之混淆電路係取作輸入 及GI(μ A ;μ b )且進行以下兩個步驟之一電路之一混淆:1)自減去遮罩(μ A ;μ b )以復原A及b;2)求解方程式(2)且返回β。 Phase 2 (630). The evaluator 110 will Sent to CSP 130, which decrypts it to obtain unencrypted . CSP 130 will then confuse the input value It is sent back to the evaluator 110. The obfuscated circuit provided by CSP 130 in the preparation phase is taken as input And GI ( μ A ; μ b ) and one of the following two steps is confused: 1) From Subtract the mask ( μ A ; μ b ) to restore A and b ; 2) Solve equation (2) and return β .
混淆電路以及對應於(μ A ;μ b )之混淆電路輸入值GI(μ A ;μ b )係在準備階段610期間獲得。在此階段中,評估器110僅需要自CSP 130接收對應於之混洗電路輸入值。注意,在此階段不存在模糊傳送(OT)。 Confusion circuit input value GI (μ A; μ b) of; confusion circuit and corresponding to a (μ b μ A) during the preparation phase 610 lines is obtained. In this phase, the evaluator 110 only needs to receive from the CSP 130 corresponding to Shuffle circuit input value . Note that there is no fuzzy transfer (OT) at this stage.
針對此第二實現方案,解密不作為電路之一部分執行。因此,實現方案並不限於選定可有效實施為一電路之一同態加密方案。替代Regev方案,建議使用Paillier方案或由Damgård及Jurik之其一般化作為用於之建立區塊。此等方案具有比Regev短之一密文擴充且需要較小密鑰。 For this second implementation, decryption is not performed as part of the circuit. Therefore, the implementation is not limited to selecting a homomorphic encryption scheme that can be effectively implemented as a circuit. Instead of the Regev scheme, it is recommended to use the Paillier scheme or the generalization of Damgård and Jurik as The building block. These schemes have one ciphertext extension shorter than Regev and require a smaller key.
針對某些應用,一相關概念在同態加密方案僅具有一部分同態性質時適用。此概念在接下來定義中變的明確。 For some applications, a related concept applies when the homomorphic encryption scheme has only a part of the homomorphic nature. This concept becomes clear in the definitions that follow.
定義1:一部分同態加密方案係一加密方案以使得且可能加上(若部分同態係加性)或乘以(若部分同態係乘性)一常數至一經加密明文而不需要私用加密密鑰。 Definition 1 : A part of the homomorphic encryption scheme is a cryptographic scheme such that it is possible to add (if part of the homomorphism is additive) or multiply (if partial homomorphism is multiplicative) a constant to an encrypted plaintext without private use. Encryption key.
此處係某些實例。 Here are some examples.
.假設表示一質體數且假設G=〈g〉係由g產生之乘性群組之一循環子群組。假設q表示G之階。針對純ElGamal加密,訊息空間係M=G。共用加密密鑰係y=g x 而私用密鑰係x。M中之一訊息m之加密係針對某些隨機在R=g r 且c=my r 之情況下藉由(R;c)表示。然後在m=c/R x 時使用秘密密鑰x復原明文m。 . Hypothesis Represents a plastid number and assumes that G = 〈 g 〉 is a multiplicative group generated by g One of the loop subgroups. Let q be the order of G. For pure ElGamal encryption, the message space is M = G. The shared encryption key is y = g x and the private key is x . The encryption of one of the messages m in M is for some random In the case of R = g r and c = my r , it is represented by ( R ; c ). Then use the secret key x to restore the plaintext m when m = c / R x .
-上述系統係相對於中之乘法部分同態:針對任何常數K M,C’=(R;Kc)係對訊息m’=Km之加密。 - the above system is relative to Multiplicative homomorphism in the middle: for any constant K M , C' = ( R ; Kc ) is the encryption of the message m' = Km .
.所謂雜湊ElGamal密碼編譯系統另外需要一雜湊函數H,針對某些參數k,將群組元素自G映射至。訊息空間係。密鑰產生係關於純ElGamal。對一訊息之加密係針對某些隨機在R=g r 且c=m+H(y r )之情況下由(R;c)表示。然後在m=c+H(R x )時使用秘密密鑰x來復原明文m。注意,「+」對應於中之加法(亦即,其可等效視為k位元串上之一XOR)。 . The so-called hash ElGamal cryptography system additionally requires a hash function H , which maps group elements from G to certain parameters k . . Information space system . The key generation is about pure ElGamal. One message Encryption is for some random In the case of R = g r and c = m + H ( y r ), it is represented by ( R ; c ). The secret key x is then used to recover the plaintext m when m = c + H ( R x ). Note that "+" corresponds to The addition in the middle (that is, it can be equivalently regarded as one of the XORs on the k- bit string).
-上述系統係關於XOR部分同態:針對任何常數,C’=(R;K+c)係對訊息m’=K+m之加密。 - The above system is about the XOR partial homomorphism: for any constant , C '= (R; K + c) based on the message m' = K + m of encryption.
為非限制性實例器件,現在假定c係依據一部分同態加密方案(即,)對(A;b)之加密,然後若(μ A ;μ b )表示M(亦即,部分同態加密之訊息空間)中之一元素,則其依據方程式(4)得出
針對某些運算子⊕。(在上文闡述中,同態性經註明為加性;其確實適用於一乘性寫入同態。) For some operators. (In the above explanation, homomorphism is noted as additive; it does apply to a multiplicative write homomorphism.)
因此,假定評估器110在M中選擇一隨機遮罩(μ A ;μ b ),如上文模糊c,且將所得值發送至CSP 130。然後,CSP 130可應用其解密密鑰且復原經遮罩之值。 Therefore, it is assumed that the evaluator 110 selects a random mask ( μ A ; μ b ) in M , as above blur c, and sends the resulting value to the CSP 130. The CSP 130 can then apply its decryption key and restore the masked value.
因此,可在將解密替換為移除遮罩之情況下應用先前章節之協定。 Therefore, the agreement of the previous section can be applied with the decryption replaced with the removal mask.
最終,注意,按照第二或第三協定使用一遮罩之手法並不限於脊狀回歸之情形。其可用於以一混合方式組合同態加密(分別部分同態加密)與混淆電路之任何應用中。 Finally, note that the use of a mask in accordance with the second or third agreement is not limited to the case of ridge regression. It can be used in any combination of homomorphic encryption (partially homomorphic encryption) and aliasing circuits in a hybrid manner.
所提出協定具有使其在真實情景中高效且實際之數個強項。首 先,不存要使用者在程序期間保持在線上。由於階段1 420係增量,因此每一使用者可提交其經加密輸入,且離開系統。 The proposed agreement has several strengths that make it efficient and practical in real situations. first First, there is no need for the user to stay online during the program. Since Phase 1 420 is an increment, each user can submit their encrypted input and leave the system.
此外,系統100可容易應用於執行脊狀回歸多次。假定評估器110希望執行l估計,其可在準備階段410自CSP 130提取l混淆電路。多重估計可用於適應新使用者120之到達。特定而言,由於共用密鑰係長效的,因此該等共用密鑰不需要過於經常再新,意味著當新使用者提交較多對(A i ;b i )至評估器110時,評估器可用先前值對該等對求和且計算一經更新β。儘管此程序要求利用一新混淆電路,但已提交其輸入之使用者並不需要重新提交該等輸入。 Moreover, system 100 can be readily applied to perform ridge regression multiple times. Assumed evaluator 110 wants to perform estimation l, 410 which may be extracted from the CSP 130 l confusion circuit in the preparation phase. Multiple estimates can be used to accommodate the arrival of new users 120. In particular, since the shared key is long-lived, the common keys do not need to be renewed too often, meaning that when the new user submits more pairs ( A i ; b i ) to the evaluator 110, the evaluator The pairs can be summed with the previous values and the updated β is calculated. Although this procedure requires the use of a new obfuscated circuit, the user who has submitted their input does not need to resubmit the input.
最終,所需通信之量顯著限於一秘密共用方案中之通信之量,且僅評估器110及CSP 130使用模糊傳送(OT)通信。亦注意,在階段1 420中並不使用公用密鑰加密方案,使用者可使用任何手段來段建立與評估器110之一安全通信,諸如例如,SSL。 Finally, the amount of communication required is significantly limited to the amount of communication in a secret sharing scheme, and only evaluator 110 and CSP 130 use fuzzy transmission (OT) communication. It is also noted that the public key encryption scheme is not used in stage 1 420, and the user can use any means to securely communicate with one of the evaluators 110, such as, for example, SSL.
回想,矩陣A係在中且向量b係在中。因此,假定k表示用於編碼實數之位元大小,矩陣A及向量b分別需要d 2 k個位元及dk個位元用於其表示。第二協定在M中需要一隨機遮罩(μ A ;μ b )。假定,同態加密方案係建立在其中A及b之每一項目經個別Paillier加密之Paillier方案之上。在此情形中,)之訊息空間M係由針對RSA模組N之中之(d 2 +d)個元素構成。但由於彼等元素係k位元值,因此不需要在整個範圍中獲得對應遮罩值。將算出針對某些(相對短)安全長度l之任何(k+l)位元值,只要其在統計上隱藏對應項目。實務上,此在準備階段中導致較少模糊傳送且導致一較小混淆電路。 Recall that matrix A is in Medium and vector b are in in. Therefore, assuming k represents the bit size used to encode the real number, matrix A and vector b require d 2 k bits and dk bits, respectively, for their representation. The second protocol requires a random mask ( μ A ; μ b ) in M. Assume that a homomorphic encryption scheme It is based on the Paillier scheme in which each of A and b is encrypted by individual Paillier. In this case, ) Of the system by the message space M for the RSA module N It consists of ( d 2 + d ) elements. But since their elements are k- bit values, they don't need to be in the entire range. Get the corresponding mask value. Any ( k + l) bit values for some (relatively short) secure lengths l will be calculated as long as they statistically hide the corresponding items. In practice, this results in less blurring in the preparation phase and results in a less obfuscated circuit.
改良效率之另一方式係經由一標準分批次技術,亦即,將A及b之多個明文項目包裝至一單個Paillier密文中。舉例而言,將20個明文值包裝至一單個Paillier密文(由足夠多0分離)中將使階段1之運行時間 減少到1/20。 Another way to improve efficiency is through a standard batching technique, that is, packaging multiple plaintext items of A and b into a single Paillier ciphertext. For example, wrapping 20 plaintext values into a single Paillier ciphertext (separated by enough zeros) will reduce the run time of Phase 1 to 1/20.
為評估隱私保護系統之實用性,系統經實施且對合成資料集及真實資料集進行測試。實施上文所提出之第二協定,此乃因其在混淆電路內不需要解密,且允許使用對階段1(僅涉及求和)高效之同態加密。 To assess the usefulness of the privacy protection system, the system was implemented and tested on synthetic data sets and real data sets. The second protocol proposed above is implemented because it does not require decryption within the obfuscation circuit and allows for efficient homomorphic encryption for phase 1 (which only involves summation).
如上文所論述,針對同態加密,Paillier方案與一1024個位元長模組一起使用,此對應於80位元安全位準。為加速階段1,亦如上文中所概述實施分批次。已知n個使用者貢獻其輸入,可分批成1024個位元之一個Paillier密文之元素之數目係1024=(b+log2 n),其中b係用於表示數目之位元之總數目。如下文所論述,b係依據所期望準確度判定,因此在此實驗中,在15與30個元素之間分批次。 As discussed above, for homomorphic encryption, the Paillier scheme is used with a 1024-bit long module, which corresponds to an 80-bit security level. To speed up Phase 1, the batches were also implemented as outlined above. It is known that n users contribute their inputs, and the number of elements of a Paillier ciphertext that can be batched into 1024 bits is 1024 = ( b + log 2 n ), where b is used to represent the total number of bits. Head. As discussed below, b is determined based on the desired accuracy, so in this experiment, batches were divided between 15 and 30 elements.
系統係建立在FastGC(使得開發者能夠使用基本XOR、OR及AND閘定義任意電路之一基於Java之開放原始碼框架)之上。一旦電路經構造,框架處置混淆電路之混淆、模糊傳送及完整評估。FastGC包含數個最佳化。首先,使用「免費XOR」技術顯著減少電路中之XOR之通信及計算成本。第二,使用混淆列減少技術,FastGC使k扇入非XOR閘之通信成本減少l=2 k ,此產生一25%通信節省,此乃因框架中僅定義2扇入閘。第三,FastGC實施OT延伸,該OT延伸可以k個OT且每額外OT數個對稱密鑰操作為代價執行實際上無限數目個傳送。最終,最後最佳化係簡潔「加入3個位元」電路,此定義具有四個XOR閘(所有XOR閘在通信及計算方面係「免費」)及僅一個AND閘之一電路。FastGC使得混淆及評估同時發生。更具體而言,CSP 130在混淆表以由電路結構定義之次序產生時將該等混淆表傳輸至評估器 110。評估器110然後判定哪一閘將接下來基於可用輸出值及表評估。一旦一閘經評估,其對應表立即被摒棄。此總計與離線預計算所有混淆電路相同之計算及通訊成本,但使記憶體消費達至一常數。 The system is built on FastGC (which enables developers to use a basic XOR, OR, and AND gate to define one of the Java-based open source frameworks for any circuit). Once the circuit is constructed, the framework handles obfuscation, fuzzy transmission, and complete evaluation of the obfuscated circuitry. FastGC includes several optimizations. First, using the "free XOR" technology significantly reduces the communication and computational cost of XOR in the circuit. Second, using the confusion column reduction technique, FastGC reduces the communication cost of k- fan into non-XOR gates by 1 = 2 k , which results in a 25% communication savings, since only 2 fans are defined in the framework. Third, FastGC implements an OT extension that can perform k OTs and perform virtually unlimited number of transfers at the expense of each additional OT number of symmetric key operations. In the end, the final optimization is a simple "add 3 bit" circuit. This definition has four XOR gates (all XOR gates are "free" for communication and computation) and only one AND gate. FastGC makes both confusion and evaluation happen simultaneously. More specifically, the CSP 130 transmits the obfuscated tables to the evaluator 110 when the obfuscation tables are generated in the order defined by the circuit structure. The evaluator 110 then determines which gate will then be evaluated based on the available output values and tables. Once a gate is evaluated, its correspondence table is immediately discarded. This total is the same calculation and communication cost as offline pre-calculation of all obfuscated circuits, but results in a constant consumption of memory.
本發明方法之主要挑戰中之一者係設計求解如方程式(2)中定義之線性系統Aβ=b之一電路。當將一函數實施為一混淆電路時,較佳使用係資料不可知(亦即,其執行路徑不依賴於輸入)之操作。舉例而言,由於輸入經混淆,因此評估器110需要執行一若-則-否則敍述之所有可能路徑,此在存在巢套條件敍述之情況下導致電路大小及執行時間兩者至一指數增長。此使得用於求解需要樞軸消元之線性系統之傳統演算法中之任何者(諸如例如高斯消去)不實用。 One of the main challenges of the method of the present invention is to design a circuit that solves one of the linear systems Aβ = b as defined in equation (2). When a function is implemented as a confusing circuit, it is preferred to use an operation in which the data is agnostic (i.e., its execution path does not depend on the input). For example, since the inputs are confusing, the evaluator 110 needs to perform all possible paths of if-then- otherwise, which results in an exponential increase in both circuit size and execution time in the presence of nested conditional statements. This makes any of the traditional algorithms for solving linear systems that require pivotal cancellations, such as, for example, Gaussian elimination, impractical.
為簡潔起見,此系統實施下文所呈現之標準喬裏斯基演算法。然而,注意其複雜性可進一步減小至與使用類似技術之區塊式反演相同之複雜性。 For the sake of brevity, this system implements the standard Jollysky algorithm presented below. However, note that its complexity can be further reduced to the same complexity as block-type inversion using similar techniques.
存在用於求解線性系統之數個可能分解方法。喬裏斯基分解係僅當矩陣A係對稱正定性時可用之用於求解一線性系統之一資料不可知方法。喬裏斯基之主要優點係其係數值穩健而不需要樞軸消元。特定而言,其極其適於定點數表示。 There are several possible decomposition methods for solving linear systems. The Jolski decomposition is used to solve the data agnostic method of a linear system only when the matrix A is symmetric positive. The main advantage of Jorysky is that its coefficient values are robust and do not require pivotal elimination. In particular, it is extremely suitable for fixed point representations.
由於針對λ>0,實際上係一正定矩陣,因此喬裏斯基經選擇作為在此實施方案中求解Aβ=b之方法。 Since for λ >0, In fact, a positive definite matrix is used, so Jorysky is chosen as the method for solving Aβ = b in this embodiment.
下文簡要概述喬裏斯基分解之主要步驟。該演算法構造一下三角矩陣L以使得A=L T L:求解系統Aβ=b,然後簡化成求解以下兩個系統:L T y=b;且Lβ=y The following is a brief overview of the main steps of the Chorissky decomposition. The algorithm is configured such that at triangular matrix L A = L T L: solving system Aβ = b, then reduced to solving the following two systems: L T y = b; and Lβ = y
由於矩陣L及LT係三角形,因此此等系統可使用後置法來容易求 解。此外,由於矩陣A係正定的,因此矩陣L需要在對角線上具有非零值,因此不需要任何樞軸消元。 Since the matrix L and the LT are triangles, these systems can be easily solved using the post method. solution. Furthermore, since matrix A is positively definite, matrix L needs to have a non-zero value on the diagonal, so no pivoting extinction is needed.
圖7中所示之演算法1中闡述分解A=L T L。其設計Θ(d 3 )加法、Θ(d 3 )乘法、Θ(d 2 )除法及Θ(d)平方根運算。此外,上文透過向後消去之兩個系統之解涉及Θ(d 2 )加法、Θ(d 2 )乘法及Θ(d)除法。下文論述作為電路之此等運算之實施方案。 The decomposition A = L T L is illustrated in Algorithm 1 shown in FIG. It is designed for Θ( d 3 ) addition, Θ ( d 3 ) multiplication, Θ ( d 2 ) division, and Θ ( d ) square root operation. In addition, the solutions to the two systems that are eliminated by backwards involve Θ( d 2 ) addition, Θ( d 2 ) multiplication, and Θ( d ) division. Embodiments of such operations as circuits are discussed below.
為求解線性系統(2),需要以一二進制形式準確地表示實數。用於表示實數之兩個可能方法認為係:浮點及定點。一實數a之浮點表示係由公式表達:[a]=[m;p];其中 To solve the linear system (2), it is necessary to accurately represent the real numbers in a binary form. Two possible methods for representing real numbers are considered to be: floating point and fixed point. The floating point representation of a real number a is expressed by the formula: [a]=[ m ; p ];
浮點表示具有適應實際任意量值之數之優點。然而,對浮點表示之基本運算(諸如加法)難以以一資料不可知方式實施。更重要地,使用喬裏斯基成為使用定點表示之依據,定點表示明顯較易於實施。已知一實數a,其定點表示由下式表達:,其中指數p係固定的。 Floating point representation has the advantage of adapting to the actual number of values. However, basic operations on floating point representations (such as addition) are difficult to implement in a data agnostic manner. More importantly, using Jorrissky to become the basis for using fixed-point representations, fixed-point representations are significantly easier to implement. A real number a is known, and its fixed point representation is expressed by: , where the index p is fixed.
如本文中所論述,需要執行之運算中之諸多者可經由定點數以一資料不可知方式實施。如此,經產生用於定點表示之電路更小。此外,回想,脊狀回歸xi之輸入變數通常經調節至相同值域(介於-1與1之間)以確保β之係數係可比較的,且實現數值穩定性。在此一設定中,已知,可用定點數對A執行喬裏斯基分解,而不導致溢出。此外,已知y i 之界限及矩陣A之條件數,可在以該方法求解上兩個三角系統時計算需要防止溢出之位元。因此,使用定點表示實施系統。分式部分之位元之數目p可經選定作為一系統參數,且在系統之準確度與所產生電路之大小之間形成一折衷。然而,可基於所要準確度以一原則方式進行選定p。負數係使用標準2的補數表示來表示。 As discussed herein, many of the operations that need to be performed can be implemented in a data agnostic manner via fixed point numbers. As such, the circuitry produced for the fixed point representation is smaller. Furthermore, recall that the input variables of the ridge regression xi are typically adjusted to the same range of values (between -1 and 1) to ensure that the coefficients of beta are comparable and achieve numerical stability. In this setting, it is known that the Cholesky decomposition can be performed on A with a fixed number of points without causing an overflow. Further, it is known limit of y i and the condition number of the matrix A, may be calculated on solving two triangular systems in this manner is necessary to prevent overflow of bits. Therefore, the implementation system is expressed using fixed points. The number p of bits of the fractional portion can be selected as a system parameter and form a compromise between the accuracy of the system and the size of the resulting circuit. However, the selection p can be made in a principled manner based on the desired accuracy. Negative numbers are represented using the complement 2 representation of Standard 2.
本文中所揭示之各種實施例可實施為硬體、韌體、軟體或其任何組合。此外,較佳地將該軟體實施為有形地體現於一程式儲存單元或電腦可讀取媒體上之一應用程式。該應用程式可上傳至包括任一適合架構之一機器且由該機器執行。較佳地,將該機器實施於具有諸如一或多個中央處理單元(「CPU」)、一記憶體及輸入/輸出介面等硬體之一電腦平臺上。該電腦平臺亦可包含一作業系統及微指令碼。本文中所闡述之各種處理程序及功能可係可由一CPU執行之微指令碼之部分或應用程式之部分或者其任一組合,無論是否明確展示此電腦或處理器。另外,各種其他周邊單元(諸如一額外資料儲存單元及一列印單元)可連接至電腦平臺。 The various embodiments disclosed herein can be implemented as a hardware, a firmware, a soft body, or any combination thereof. In addition, the software is preferably implemented as an application tangibly embodied in a program storage unit or a computer readable medium. The application can be uploaded to and executed by one of the machines including any suitable architecture. Preferably, the machine is implemented on a computer platform having hardware such as one or more central processing units ("CPUs"), a memory, and an input/output interface. The computer platform can also include an operating system and microinstruction code. The various processing procedures and functions set forth herein may be part of a microinstruction code executed by a CPU or part of an application, or any combination thereof, whether or not the computer or processor is explicitly shown. In addition, various other peripheral units, such as an additional data storage unit and a printing unit, can be connected to the computer platform.
本文中所陳述之所有實例及條件語言出於指導性目的意欲幫助讀者理解實施例之原理及由發明者貢獻以推廣此項技術之概念且應視為不限於此等具體陳述之實例及條件。此外,本文中陳述本發明之原理、態樣及實施例以及其特定實例之所有敍述意欲囊括其結構等效物及功能等效物兩者。另外,此等等效物意欲包含目前已知之等效物以及未來將要開發之等效物(例如,不管結構如何而執行相同功能之所開發之任何元件)兩者。 All of the examples and conditional language set forth herein are intended to assist the reader in understanding the principles of the embodiments and the embodiments of the invention. Moreover, all statements herein reciting principles, aspects, and embodiments of the invention, as well as specific examples thereof, are intended to include both structural equivalents and functional equivalents. Rather, these equivalents are intended to encompass both such equivalents and the equivalents that are to be developed in the future, such as any element that is developed to perform the same function regardless of the structure.
100‧‧‧系統 100‧‧‧ system
110‧‧‧評估器 110‧‧‧Evaluator
120‧‧‧使用者 120‧‧‧Users
130‧‧‧密碼編譯服務提供者 130‧‧‧Cryptographic Compilation Service Provider
140‧‧‧純文字預測模型β/學習模型β/模型β 140‧‧‧Pure text prediction model β/learning model β/model β
Claims (15)
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201361772404P | 2013-03-04 | 2013-03-04 |
Publications (1)
Publication Number | Publication Date |
---|---|
TW201448552A true TW201448552A (en) | 2014-12-16 |
Family
ID=49301694
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW103107293A TW201448552A (en) | 2013-03-04 | 2014-03-04 | Privacy-preserving ridge regression |
TW103107292A TW201448551A (en) | 2013-03-04 | 2014-03-04 | Privacy-preserving ridge regression using partially homomorphic encryption and masks |
TW103107291A TW201448550A (en) | 2013-03-04 | 2014-03-04 | Privacy-preserving ridge regression using masks |
Family Applications After (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW103107292A TW201448551A (en) | 2013-03-04 | 2014-03-04 | Privacy-preserving ridge regression using partially homomorphic encryption and masks |
TW103107291A TW201448550A (en) | 2013-03-04 | 2014-03-04 | Privacy-preserving ridge regression using masks |
Country Status (7)
Country | Link |
---|---|
US (3) | US20150381349A1 (en) |
EP (3) | EP2965461A1 (en) |
JP (3) | JP2016512611A (en) |
KR (3) | KR20150123823A (en) |
CN (1) | CN105814832A (en) |
TW (3) | TW201448552A (en) |
WO (3) | WO2014137392A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI775467B (en) * | 2021-06-02 | 2022-08-21 | 宏碁智醫股份有限公司 | Machine learning model file decryption method and user device |
Families Citing this family (38)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2015131394A1 (en) * | 2014-03-07 | 2015-09-11 | Nokia Technologies Oy | Method and apparatus for verifying processed data |
US9825758B2 (en) | 2014-12-02 | 2017-11-21 | Microsoft Technology Licensing, Llc | Secure computer evaluation of k-nearest neighbor models |
US9787647B2 (en) * | 2014-12-02 | 2017-10-10 | Microsoft Technology Licensing, Llc | Secure computer evaluation of decision trees |
CN104598835A (en) * | 2014-12-29 | 2015-05-06 | 无锡清华信息科学与技术国家实验室物联网技术中心 | Cloud-based real number vector distance calculation method for protecting privacy |
US9641318B2 (en) * | 2015-01-06 | 2017-05-02 | Google Inc. | Systems and methods for a multiple value packing scheme for homomorphic encryption |
US9846785B2 (en) | 2015-11-25 | 2017-12-19 | International Business Machines Corporation | Efficient two party oblivious transfer using a leveled fully homomorphic encryption |
US10095880B2 (en) | 2016-09-01 | 2018-10-09 | International Business Machines Corporation | Performing secure queries from a higher security domain of information in a lower security domain |
WO2018151552A1 (en) * | 2017-02-15 | 2018-08-23 | Lg Electronics Inc. | Apparatus and method for generating ciphertext data with maintained structure for analytics capability |
WO2018174873A1 (en) * | 2017-03-22 | 2018-09-27 | Visa International Service Association | Privacy-preserving machine learning |
US11018875B2 (en) * | 2017-08-31 | 2021-05-25 | Onboard Security, Inc. | Method and system for secure connected vehicle communication |
EP3461054A1 (en) | 2017-09-20 | 2019-03-27 | Universidad de Vigo | System and method for secure outsourced prediction |
CN111611618B (en) * | 2017-10-31 | 2023-08-04 | 创新先进技术有限公司 | Data statistics method and device |
CN109756442B (en) * | 2017-11-01 | 2020-04-24 | 清华大学 | Data statistics method, device and equipment based on garbled circuit |
JP6391900B1 (en) * | 2017-11-27 | 2018-09-19 | 三菱電機株式会社 | Homomorphic reasoning apparatus, homomorphic reasoning method, homomorphic reasoning program, and secret information processing system |
US11818249B2 (en) * | 2017-12-04 | 2023-11-14 | Koninklijke Philips N.V. | Nodes and methods of operating the same |
JP6988918B2 (en) * | 2017-12-18 | 2022-01-05 | 日本電信電話株式会社 | Secret calculation system and method |
WO2019121384A1 (en) * | 2017-12-22 | 2019-06-27 | Koninklijke Philips N.V. | Evaluation of events using a function |
KR102411883B1 (en) * | 2018-01-11 | 2022-06-22 | 삼성전자주식회사 | Electronic device, server and control method thereof |
US11210428B2 (en) * | 2018-06-06 | 2021-12-28 | The Trustees Of Indiana University | Long-term on-demand service for executing active-secure computations |
US11050725B2 (en) * | 2018-07-16 | 2021-06-29 | Sap Se | Private benchmarking cloud service with enhanced statistics |
CN109190395B (en) * | 2018-08-21 | 2020-09-04 | 浙江大数据交易中心有限公司 | Fully homomorphic encryption method and system based on data transformation |
EP3881263A1 (en) | 2018-11-15 | 2021-09-22 | Ravel Technologies Sarl | Cryptographic anonymization for zero-knowledge advertising methods, apparatus, and system |
SG11202108675SA (en) * | 2019-02-13 | 2021-09-29 | Agency Science Tech & Res | Method and system for determining an order of encrypted inputs |
US11250140B2 (en) * | 2019-02-28 | 2022-02-15 | Sap Se | Cloud-based secure computation of the median |
US11245680B2 (en) * | 2019-03-01 | 2022-02-08 | Analog Devices, Inc. | Garbled circuit for device authentication |
CN109992979B (en) * | 2019-03-15 | 2020-12-11 | 暨南大学 | Ridge regression training method, computing device and medium |
US10778410B2 (en) | 2019-06-18 | 2020-09-15 | Alibaba Group Holding Limited | Homomorphic data encryption method and apparatus for implementing privacy protection |
CN110348231B (en) * | 2019-06-18 | 2020-08-14 | 阿里巴巴集团控股有限公司 | Data homomorphic encryption and decryption method and device for realizing privacy protection |
US11250116B2 (en) * | 2019-10-25 | 2022-02-15 | Visa International Service Association | Optimized private biometric matching |
US11507883B2 (en) * | 2019-12-03 | 2022-11-22 | Sap Se | Fairness and output authenticity for secure distributed machine learning |
CN111324870B (en) * | 2020-01-22 | 2022-10-11 | 武汉大学 | Outsourcing convolutional neural network privacy protection system based on safe two-party calculation |
US10797866B1 (en) * | 2020-03-30 | 2020-10-06 | Bar-Ilan University | System and method for enforcement of correctness of inputs of multi-party computations |
US11308234B1 (en) | 2020-04-02 | 2022-04-19 | Wells Fargo Bank, N.A. | Methods for protecting data |
KR20210147645A (en) | 2020-05-29 | 2021-12-07 | 삼성전자주식회사 | Homomorphic encryption device and cyphertext operation method thereof |
US11599806B2 (en) | 2020-06-22 | 2023-03-07 | International Business Machines Corporation | Depth-constrained knowledge distillation for inference on encrypted data |
US11902424B2 (en) * | 2020-11-20 | 2024-02-13 | International Business Machines Corporation | Secure re-encryption of homomorphically encrypted data |
KR102633416B1 (en) * | 2021-05-04 | 2024-02-05 | 서울대학교산학협력단 | Method for privacy preserving using homomorphic encryption with private variables and apparatus theroef |
KR102615381B1 (en) * | 2021-08-24 | 2023-12-19 | 서울대학교산학협력단 | Method for privacy preserving using homomorphic encryption with private variables and apparatus theroef |
Family Cites Families (7)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
WO2006007621A2 (en) * | 2004-07-22 | 2006-01-26 | Avl List Gmbh | Method for analyzing the behavior of complex systems, especially internal combustion engines |
US8443205B2 (en) * | 2008-01-08 | 2013-05-14 | Alcatel Lucent | Secure function evaluation techniques for circuits containing XOR gates with applications to universal circuits |
US8762736B1 (en) * | 2008-04-04 | 2014-06-24 | Massachusetts Institute Of Technology | One-time programs |
US8538102B2 (en) * | 2008-12-17 | 2013-09-17 | Synarc Inc | Optimised region of interest selection |
US8539220B2 (en) * | 2010-02-26 | 2013-09-17 | Microsoft Corporation | Secure computation using a server module |
US8861716B2 (en) * | 2010-03-30 | 2014-10-14 | International Business Machines Corporation | Efficient homomorphic encryption scheme for bilinear forms |
US8837715B2 (en) * | 2011-02-17 | 2014-09-16 | Gradiant, Centro Tecnolóxico de Telecomunicacións de Galica | Method and apparatus for secure iterative processing and adaptive filtering |
-
2013
- 2013-09-25 JP JP2015561325A patent/JP2016512611A/en not_active Withdrawn
- 2013-09-25 KR KR1020157023956A patent/KR20150123823A/en not_active Application Discontinuation
- 2013-09-25 EP EP13771751.8A patent/EP2965461A1/en not_active Withdrawn
- 2013-09-25 WO PCT/US2013/061690 patent/WO2014137392A1/en active Application Filing
- 2013-09-25 EP EP13777187.9A patent/EP2965463A1/en not_active Withdrawn
- 2013-09-25 US US14/767,569 patent/US20150381349A1/en not_active Abandoned
- 2013-09-25 JP JP2015561327A patent/JP2016512612A/en not_active Withdrawn
- 2013-09-25 EP EP13776627.5A patent/EP2965462A1/en not_active Withdrawn
- 2013-09-25 KR KR1020157024118A patent/KR20150143423A/en not_active Application Discontinuation
- 2013-09-25 CN CN201380074255.6A patent/CN105814832A/en active Pending
- 2013-09-25 JP JP2015561326A patent/JP2016510908A/en not_active Withdrawn
- 2013-09-25 WO PCT/US2013/061696 patent/WO2014137393A1/en active Application Filing
- 2013-09-25 US US14/767,568 patent/US20160036584A1/en not_active Abandoned
- 2013-09-25 WO PCT/US2013/061698 patent/WO2014137394A1/en active Application Filing
- 2013-09-25 US US14/771,771 patent/US20160020898A1/en not_active Abandoned
- 2013-09-25 KR KR1020157024129A patent/KR20160002697A/en not_active Application Discontinuation
-
2014
- 2014-03-04 TW TW103107293A patent/TW201448552A/en unknown
- 2014-03-04 TW TW103107292A patent/TW201448551A/en unknown
- 2014-03-04 TW TW103107291A patent/TW201448550A/en unknown
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI775467B (en) * | 2021-06-02 | 2022-08-21 | 宏碁智醫股份有限公司 | Machine learning model file decryption method and user device |
Also Published As
Publication number | Publication date |
---|---|
TW201448550A (en) | 2014-12-16 |
TW201448551A (en) | 2014-12-16 |
JP2016512612A (en) | 2016-04-28 |
KR20150143423A (en) | 2015-12-23 |
US20160020898A1 (en) | 2016-01-21 |
KR20160002697A (en) | 2016-01-08 |
WO2014137394A1 (en) | 2014-09-12 |
JP2016510908A (en) | 2016-04-11 |
KR20150123823A (en) | 2015-11-04 |
WO2014137393A1 (en) | 2014-09-12 |
JP2016512611A (en) | 2016-04-28 |
US20150381349A1 (en) | 2015-12-31 |
EP2965461A1 (en) | 2016-01-13 |
EP2965463A1 (en) | 2016-01-13 |
WO2014137392A1 (en) | 2014-09-12 |
CN105814832A (en) | 2016-07-27 |
EP2965462A1 (en) | 2016-01-13 |
US20160036584A1 (en) | 2016-02-04 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
TW201448552A (en) | Privacy-preserving ridge regression | |
Giacomelli et al. | Privacy-preserving ridge regression with only linearly-homomorphic encryption | |
Wang et al. | Secure optimization computation outsourcing in cloud computing: A case study of linear programming | |
Nikolaenko et al. | Privacy-preserving ridge regression on hundreds of millions of records | |
Liu et al. | Secure model fusion for distributed learning using partial homomorphic encryption | |
Naveed et al. | Controlled functional encryption | |
CN111898145B (en) | Neural network model training method, device, equipment and medium | |
Fan et al. | PPMCK: Privacy-preserving multi-party computing for K-means clustering | |
CN106170943A (en) | Use the secret protection ridge regression of part homomorphic cryptography and mask | |
Soykan et al. | A survey and guideline on privacy enhancing technologies for collaborative machine learning | |
Ibarrondo et al. | Banners: Binarized neural networks with replicated secret sharing | |
CN105721146A (en) | Big data sharing method for cloud storage based on SMC | |
Liu et al. | DHSA: efficient doubly homomorphic secure aggregation for cross-silo federated learning | |
EP3364397B1 (en) | Secret authentication code adding device, secret authentification code adding method, and program | |
Shen et al. | Privacy-preserving multi-party deep learning based on homomorphic proxy re-encryption | |
Suegami | Smart contracts obfuscation from blockchain-based one-time program | |
Wang et al. | A flexible and privacy-preserving federated learning framework based on logistic regression | |
CN116455575B (en) | Key generation, encryption and decryption methods, electronic equipment and storage medium | |
Ren et al. | Application: Privacy, Security, Robustness and Trustworthiness in Edge AI | |
Xie | BatchEncryption: Localized Federated Learning in Preserving-privacy with Efficient Integer Vector Homomorphic Encryption | |
Huang et al. | Secure Neural Network Prediction in the Cloud-Based Open Neural Network Service | |
Singamaneni et al. | A Novel Integrated Quantum-Resistant Cryptography for Secure Scientific Data Exchange in Ad Hoc Networks | |
Anguraju et al. | Post Quantum Steganography for Cloud Privacy Preservation using Multivariable Quadratic Polynomial | |
Mane et al. | Functional encryption implementation to protect storage data in the cloud | |
Liu et al. | Integrating Homomorphic Encryption and Trusted Execution Technology for Autonomous and Confidential Model Refining in Cloud |